Privacy Policy

The Professional Sycophants (“TPS”, including Bulletin and Koi) is operated by [Operator legal name — e.g. Forge d'Arcadie inc.], [Registered address], Québec, Canada (“we”). This policy explains how we handle personal information. We apply Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and, where applicable, Canada's PIPEDA.

Person in charge of the protection of personal information

Person in charge of the protection of personal information: [Name], tpssupport@forgearcadie.com. Contact them for any question, access or correction request, or complaint. You may also complain to the Commission d'accès à l'information du Québec.

Privacy by default

New accounts start with the most protective settings: your profile is visible to signed-in members only (not search engines), your Unfiltered Résumé is visible only to you, messages are limited to your connections, and your Koi candidate profile is not discoverable by employers. You choose what to open up in Settings → Privacy.

What we collect and why

• Account: email address, display name, a salted password hash (never the password itself), optional Google account identifier, and optional two-step verification secret (encrypted). Used to create and secure your account.
• Profile and content: what you choose to add — photo, headline, location, experience, skills, posts, comments, reactions, Bulletin notices, evidence, outreach records, messages, nominations. Used to provide the service you asked for.
• Koi: candidate profile, résumé, introduction video, answers to employer questions, applications and messages with employers; for employers, organization and job details. Used to run the recruitment process you take part in.
• Technical: IP address and browser user-agent for signed-in sessions, security logs and abuse prevention (rate limits). We don't use advertising trackers or third-party analytics.
• Consent records: which version of our policies you accepted, and when.

We do not sell personal information, and we don't use it for advertising.

Who can see what

• Posts are visible to the audience you choose (anyone, members, or connections). Bulletin notices, their discussion, outreach records and company responses are public.
• Koi applications — including files and videos — are visible only to you and the verified recruiters of the organization you applied to. Your TPS posts are never included. If you withdraw, the employer loses access to your shared materials immediately.
• Moderators can access content when needed to review reports or enforce our Community Guidelines. Every moderation action is logged.

Service providers and international processing

We use Cloudflare (hosting, database, file storage, bot protection), Resend (transactional email) and, if you choose it, Google (sign-in). These providers may process information outside Québec, including in the United States. Before communicating information outside Québec we assess whether it will receive adequate protection, and we bind providers by contract to use it only to provide their service to us.

Retention

• Sign-in sessions expire after 30 days of inactivity. Email links expire within 24 hours.
• Read notifications are deleted after 90 days; abuse-prevention counters after 2 days.
• Closed or withdrawn Koi applications, and the answer videos recorded for them, are deleted 12 months after their last update.
• Security and moderation logs are kept for 24 months.
• Everything else is kept until you delete it or your account.

Your rights

You can access and download your data (Settings → Account → Download my data), correct it at any time, withdraw consent, ask us to stop disseminating information or de-index it, and delete your account. Deleting your account permanently removes your profile, posts, comments, connections, messages, Koi profile, applications and uploaded files. Bulletin notices you pinned remain part of the public record, attributed to “Former member”. We answer written requests within 30 days.

Security

We use HTTPS everywhere, secure same-site cookies, server-side authorization for every action, rate limiting, upload validation, encrypted two-step secrets, and mandatory two-step verification for administrators. If a confidentiality incident presents a risk of serious injury, we will notify you and the Commission as the law requires.

Children

TPS is for people aged 16 and over. We don't knowingly collect information from younger children.

Changes

We'll tell you about material changes before they take effect and ask for your agreement where required.